What security does the GDPR require of a small business?

Appropriate security is risk-based, not a fixed checklist

Article 32 of the GDPR does not require a fixed list of technical measures, but a level of security appropriate to the risk that processing of personal data entails. The regulation identifies four things to take into account: the state of the art, the cost of implementation, the nature, scope, context and purposes of the processing, and the risks to the rights and freedoms of the individuals whose data are processed. As examples of measures, the article mentions inter alia pseudonymisation and encryption, the ability to ensure the confidentiality, integrity, availability and resilience of systems, the ability to restore availability and access to personal data in a timely manner after an incident, and a process to test the effectiveness of measures on a regular basis.

What this means for a small business varies depending on what data is being processed. An online shop that only keeps name and shipping address is in a different risk category than a medical practice that processes health data or an agency that tracks visitor behaviour on a large scale. Security that is appropriate for one — for example access controls, password policies and regular backups — may not be sufficient for another. The regulation asks you to make that assessment and to be able to demonstrate that you have made it, not to meet one fixed standard.

Where this follows from Article 32 GDPR

This requirement is set out directly in Article 32 of the GDPR, which as a regulation applies equally in every Member State — the core of what "appropriate" means therefore does not differ between countries. What does differ is who oversees compliance: in the Netherlands it is the Dutch Data Protection Authority, in Germany it is the data protection authority of the state where the business is established. For further guidance, the Dutch Data Protection Authority publishes practical information on the security of personal data.